Active Directory Certificate Services: ESC1 Through ESC8 in Practice
Why certificate services are the most reliable escalation path in enterprise AD, and the eight misconfigurations worth checking on every engagement.
Privilege Escalation
BloodHound and SharpHound: Mapping Active Directory Attack Paths
How to collect the right AD data once, then query it as a graph instead of guessing your way to Domain Admin.